syslog is a standard for logging messages about the operation of a system.

learn more… | top users | synonyms

0
votes
1answer
56 views

same filter works in rsyslog but not syslog

I have the following filters in new cpanel server with rsyslog to forward log to a central log server(use rsyslog), but these filters didn't work in older cpanel server with syslog. I don't see any ...
0
votes
0answers
52 views

How to change the default template in syslog-ng

Is it possible to change the default template for all destinations in syslog-ng? I know that I can declare a template: template t_tmpl { template("$ISODATE $MSGHDR$MSG\n"); }; and then reference ...
0
votes
0answers
57 views

snort is not alerting to a web console

I am configuring snort in OSSIM, modified the snort.debian.conf and when I check the status it gives OK. But it is not logging as I have checked the file. How can I get the alerts logged and on the ...
3
votes
0answers
164 views

How do you use patterndb variables in syslog-ng?

I'd like to parse some custom (network appliance) syslog files to create my own formatted output. As I am new to syslog-ng & patterndb I have been trying to build an example using the ...
1
vote
0answers
197 views

rsyslog logging same data to multiple files

I'm new to configuring rsyslog for centralized logging and was wondering if one of you experts could help me with the following problem. I am trying to store logs for each remote host to a per host ...
1
vote
2answers
1k views

Cisco ASA syslog format description [closed]

Where can I find Cisco ASA syslog format description? Log example: Dec 11 08:01:24 <IP> %ASA-6-302015: Built outbound UDP connection 447235 for outside:NTP_Server_2/<port> ...
0
votes
2answers
633 views

Logging ssh info using syslog-ng daemon in Cygwin

I have setup the syslog-ng daemon using Cygwin in Windows 7. What I want to do is to log all of the ssh failed passwords, etc to /var/log/sshd.log. I tried to do this by adding the following line: ...
3
votes
0answers
130 views

Syslog-ng not logging on debian

I have syslog-ng running but it does not seem to be logging to /var/log anymore. Looking at the logs it apparently used to awhile back: -rw------- 1 root root 0 Sep 8 00:55 messages ...
2
votes
2answers
383 views

Log ssh sessions to rsyslog

How can I setup rsyslog to log commands typed in a ssh session? Just in case someone unauthorized ever accesses the system, I'd like to know what he did.
2
votes
1answer
215 views

Pipe program output to rsyslog

I have a process running that writes it's output to a file, like this. processx > /var/log/processx.log 2>&1 How would I write/pipe/forward this to rsyslog instead (including the ...
2
votes
1answer
105 views

cisco ios - syslog version

I am writing small article on Syslog and I was wondering, if there is any resource that tells me what version of Syslog is supported in what ios version? By Syslog version I mean rfc 3164/rfc ...
0
votes
0answers
84 views

Not seeing kernel messages in syslog

I'm trying to track down a process that kills my mysql server on my CentOS box. I have the following setting in /etc/syslog.conf: *.*;mail.none;authpriv.none;cron.none /var/log/messages I ...
0
votes
1answer
50 views

syslog, kernel.warning and iptables innerworking

Im tinkering with my iptables logging at the moment. So I got my syslog to use another log file with tips from the web. basically you end up changing some chains and rules plus aan extra line in the ...
0
votes
1answer
353 views

Syslog info from vmware hosts to graylog are not collecting correctly

I have a graylog syslog server running on debian, running fine. I wanted to send syslogs from our Vmware ESX hosts to Graylog. I point a ESX host to the syslog by doing the following: I open vSphere ...
0
votes
1answer
561 views

Wireshark - Capture syslog traffic form local workstation

I am using wireshark version 1.10.3 on windows 7 x64 enterprise. I am trying to capture all outbound UDP traffic, in particular syslog traffic. I have tried a capture filter UDP, but all I can see ...
0
votes
1answer
365 views

Syslog-ng how to get domain names instead of IP address

How can syslog-ng get the domain names instead of IP address that I received? I'm able to get those information but in IP address, I would like to get the DST/HOST to domain names instead of getting ...
3
votes
2answers
1k views

How does an administrator generalize alerting when an event doesn't happen?

Often my users require me to be just as responsible for knowing if an event hasn't happened. I've always had to build custom and brittle solutions with cron'ed shell scripts and lots of date edge ...
1
vote
0answers
64 views

Launchd script's output not being logged to system.log

Sample script: #!/bin/bash echo "Hello?" ... (other things) When run via launchd, it definitely runs (the other things are being done) but nothing shows up in /var/log/system.log. I'm running OS ...
1
vote
1answer
2k views

Send Apache Access Logs to syslog

We have IBM HTTP Servers (Based on Apache 2.0) and want to send the access logs to syslog. (in addition to error logs which does work) The config we are using is as follows: ErrorLog ...
3
votes
2answers
501 views

Properly Configured Rsyslog on CentOS

I'm trying to configure Rsyslog 5.8.10 on CentOS 6.4 to send Apache's error and access logs to a remote server. It's working, but I have a couple questions. UPDATE: A, B and C are the only ones ...
3
votes
5answers
4k views

Linux: how to send new lines in log files to remote syslog?

We have several applications which are generating their own plain-text log files, which I would like to forward to a remote syslog server for centralized logging. I do not have access to root on ...
0
votes
0answers
44 views

software to view logs on remote server [closed]

I have configured syslog server on my linux machine like this Linux Machine (syslog client) -- > Linux Machine (syslog server) I have configured it and its working properly. Now, the problem is I ...
1
vote
1answer
1k views

Getting logs from remote clients via rsyslog

I have freshly installed Debian 6. I am trying to get syslog server for a reason, I used to follow manual for this task. I configured /etc/rsyslog.conf on remote client server to send data via udp ...
7
votes
1answer
2k views

No more logging after upgrade to Debian Wheezy

Syslog, auth.log, kern.log and messages log files are not updated anymore after upgrading to Debian Wheezy (Debian Squeeze was previously running). How could I fix it?
2
votes
2answers
327 views

Load Balancing UDP traffic transparently

Are there any products (preferably open source) that can load balance UDP packets transparently? We need to scale our syslog servers and require the original source IP be kept intact. Alternatively ...
2
votes
1answer
672 views

Configuring JBoss AS 7.2 to log to syslog

In my standalone.xml, I have the syslog-handler configured like so: <syslog-handler name="SYSLOG" enabled="true"> <level name="INFO"/> <hostname value="i-XXXXXXX"/> ...
3
votes
2answers
328 views

Send logs to mulitple syslog servers

we have a cisco 6500 chasis and I would like to send to the logs to two separate syslog servers. At present, it is already sent to one syslog server. That goes to our security team. But we would like ...
0
votes
1answer
249 views

NTP synchronisation not visible in syslog

I am trying to set up a local NTP server for our LAN. I am able run ntpdate server_ip to manually update the time. However, ntp daemon does not seem to be logging anything into syslog, and so I can't ...
2
votes
1answer
598 views

Failing forwarding rsyslog

I have a centralised rsyslog server A that receives a bunch of logs through TCP from servers X, Y, Z. It then stores the files on disk but also forwards them to logstash server B (on a different ...
1
vote
1answer
364 views

cPanel and forwarding logs to the remote syslog server

I have fully working remote syslog server which receiving logs from servers and devices. I have try to setup cPanel/WHM syslog to forward logs to that remote server but so far I'm not seeing anything ...
2
votes
1answer
99 views

Disable syslog remote connections

I'm securing a server and closing all the ports that are not used, but i can't close the syslogd port, even worse I cannot find where the syslogd is called. This is what sockstat shows me: USER ...
1
vote
1answer
459 views

Strange syslog for my server

Today i go on my log with nano /var/log/syslog I have this, and i think it's not very good : Aug 27 06:25:02 ks3309528 rsyslogd: [origin software="rsyslogd" swVersion="4.6.4" x-pid="2235" ...
1
vote
1answer
201 views

syslogd filtering not working on FreeBSD

I am failing to get filtering by program or facility working in FreeBSD syslogd. I added local6.debug /var/log/test.log !testd *.debug /var/log/test.log to my ...
1
vote
3answers
76 views

Syslog to IPFIX

I was reading about logs (syslog) being exported in IPFIX format. And some products which do this as well. What I didn't find, was if there is any standard/known ways of doing this ?. Like if there ...
2
votes
1answer
814 views

How to send NAGIOS alerts to OSSIM server

I've installed an OSSIM server and I wanto to retrieve the alerts generated by a remote Nagios server in order to analyze them and perform correlation of security events. Before putting hands on it, ...
3
votes
3answers
190 views

To use syslog or not [closed]

Can someone make a decent case here: I want to use syslog so logging is integrated and so I can direct it based on severity etc not to mention log rotate, but at the same time I like the idea of ...
1
vote
1answer
624 views

Error setting capabilities, capability management disabled;

root@monitor:/opt/observium# service syslog-ng restart Stopping system logging: syslog-ng. Starting system logging: syslog-ngsyslog-ng: Error setting capabilities, capability management disabled; ...
2
votes
2answers
302 views

How can you filter mail.info from syslog?

How do I filter mail.info from /var/log/syslog (rsyslog.conf/Debian) while keeping messages greater than or equal to mail.warn? I've tried just about every different variation of appending and ...
3
votes
1answer
2k views

How do I setup rsyslog to send all logs to multiple remote servers?

I am trying to make rsyslog to send all logs to 2 remote servers, but it seems rsyslog only sends to the secondary server if the first one fails. *.* @@server1 *.* @@server2 If I put the above in ...
0
votes
1answer
151 views

syslog-ng 2.0.9 closing tcp connections from some clients instantly..?

I've a syslog-ng instance on 2.0.9, which is old, but... this is enterprise IT and upgrading the versions is... fun... running on Solaris 10. I have this strange problem where some clients stop being ...
0
votes
0answers
168 views

FreeBSD 7 syslog messages: “kernel: 15.xxxxxxxxxxxxxxx too long” (or “too short”)?

I'm experiencing poor performance on an old FreeBSD system and the only anomaly I see so far are syslog messages of the form: Jul 1 12:10:50 myserverXXX kernel: 16.0ccdd219377c0d80 too long Jul 1 ...
1
vote
1answer
411 views

Logstash shipper & server on the samebox

I'm trying to setup a central logstash configuration. However I would like to be sending my logs through syslog-ng and not third party shippers. This means that my logstash server is accepting via ...
3
votes
2answers
712 views

What is this in my syslog and should I be concerned?

I'm seeing a lot of the following line in /var/log/syslog: Jun 21 14:36:15 my-server kernel: [416219.080061] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:the-mac-address:08:00 SRC=0.0.0.0 ...
1
vote
0answers
114 views

How to dynamically generate $LocalHostName value rsyslog

I have set up a central remote syslog server where I am sending all my logs. There will be many machines logging to the syslog server. On the client machine, in the rsyslog.conf I am trying to modify ...
5
votes
2answers
3k views

how to filer rsyslog messages by tags

I have several applications and scripts that I want to redirect the output to custom files. I launch those applications using command | logger -t TAG I would like to filter these messages based ...
0
votes
1answer
153 views

intercept, evaluate, change syslog messages

is it possible to intercept syslog messages and evaluate (in special cases change) them before they are written into /var/log/? At the moment i m using inotify to monitor the log file and write the ...
2
votes
3answers
2k views

How do I stop postfix log info going into syslog?

We have a vps running Ubuntu 10.04.4 LTS, and while trying to find a solution to a php problem, I've become aware of what looks like a problem with the syslog system - I'm not sure though. The ...
3
votes
1answer
1k views

How to configure rsyslog to log into PostgreSQL without too much latency?

I'm trying to configure RSyslog on a Debian machine to log everythingo into PostgreSQL, while also logging as usual on disk. I'm using a pretty stock Debian configuration and I activated the related ...
-1
votes
2answers
332 views

Syslog-ng.conf csv parser lost first columns

I try to split information that come from IIS server with syslog-ng configuration. I create and fill the syslog-ng.conf but my csv parser lost the first column. let see: source s_network { ...
3
votes
3answers
547 views

Server crashes Sundays at 6 a.m. - out of memory

I have a weird problem: Every Sunday at 6 am my LAMP server crashes. Looking at the logs I see about 500 apache2 processes at the time (this is a test server without any load - especially not at 6 am) ...